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ALL  IHFORi^ATIOH  GOtTTAINED 

HEKEIN  IS  OTCLAS3IEIEC 

CATE  □5-"lS"20i7  3Y  J37Jg5T54  MSICG 


HRC-2974 


UNCLASSIFIED//F©tfe 


ALL  JBl  IIJFaK.-^TIDM  COITAIIJEE 

BEBEIU  IS  ™CLASSIFIEB 

DATE  12-Q^-2U1^  BY  J7SJ18TS0  HSICG 


Hums  Abedm  CSinton  E-maiS  ^huma^dmtor^emaal.mml  AeiaSysis 


Key  Findings 

Analysis  of  two  datasets  in  the  FBI's  possession  revealed  approximately  1,539  unique  work-related  e-mails^  involving  only  two 
parties:  hdr22@clintQnemaiLcQm  and  huma@cllntonemaiLcom  (hereafter  referred  to  as  "CA  party  e-mails").  Hillary  Clinton's 
legal  team  only  turned  over  32  CA  party  emails  to  the  State  Department  in  December  2014. 

When  conducting  their  review  of  the  -60,000  emails,  Hillary  Clinton's  legal  t£a 
huma@clintonemaiLcom  (hereafter,  "Huma  CE")  e-mail  correspondence  wi 
Huma  CE  e-mails  in  the  30,524  e-mail  dataset^  contained  another  search  ter 
names  and  emails  of  key  individuals,  "Libya,"  "Benghazi"),  indicating  Huma  C 
their  own  search  terms  to  identify  those  emails  for  production. 


e entirety  of 
Ire  work-related.  All 
process  (e.g., 
isibly  not  used  as 


Breakdown  of  all  huma(g>cllntonemaiLcom  E-mails  in  Origi 

Note:  For  taxonomy,  emails  were  counted  as  individuai  emaih 


Methodology  used  by  Clinton's  legal  team  to  identify  30,524  work-related  e-mall^^^^H  total 

1.  All  emails  containing  a ".gov"  email  address  [accounted  for  over  27,500 

2.  First  and  last  names  of  over  100  State  Department  and  US  government  officials,  including  close  aides  and  staff 

3.  Sort  by  sender/recipient  to  identify  non-obvious  or  non-recognizable  email  addresses,  misspellings  or  other  idiosyncrasies 

4.  Key  terms,  including  "Benghazi"  and  "Libya" 


The  FBI  assesses  the  2,598  Huma  CE  emails  In  the  original  dataset  were  potentially  determined  to  be  work-related  by  Clinton's 
legal  team  as  follows: 


30,524  total  emails  provided  to 
the  FBI;  2,598  hit  on  Huma  CE 

2,338  Huma  CE  emails  hit  on  a 
".aov"  email  address 

260  Huma  CE  emails  hit  on 
search  terms  other  than  ".gov" 

Other  search 
term  hit,  260 


Non-  Huma  Abedin 
key  names  and  . 
enmalls^,  2Z8 


"Libya”,  29 

^"Benghazi", 
"Tripoli",  1 


2 


Breakdown  of  huma(i>clintonema1Lcom  E-mails  in  Additional  Datasets  Acquired  by  FBI 


OriBlnal  -30,000 

Datto  Backups^ 

Cooper  BlackBerry  Backups^ 

Total  hdr22@clintonemaiLcom  DoS 

30,524 

16,276 

10,613 

[ tenu  re  e-mails  in  dataset 

1 Unique  work-related  CA  party  e-mails^ 

32 

1,085 

454 

^The  FBI  assessed  e-mails  to  be  work -related  Vf  they  were  related  to  Clinton's  official  capacity  at  DoS  (e.g.,  scheduling,  travel,  call  sheets,  personnel  appointments). 

^ According  to  Clinton's  campaign  website,  30,490  potentially  work-related  e-mails  were  provided  to  DoS  on  December  5,  2014.  On  August  6,  2015,  Williams  & 

Connolly  provided  the  FBI  a .PST  file  containing  30,524  e-mail  messages,  which  they  indicated  was  a copy  of  the  emails  provided  to  DoS. 

^According  to  information  available  on  Clinton's  campaign  website. 

* E-mails  included  in  the  *'Npn-  Huma  Abedin  key  names  and  e-mails"  group  includes  the  following  individuals:  Cheryl  Mills,  Jake  Sullivan]  jMonica  bS 

Hanley,  Sidney  BlumenthalJ  jthe  originai  e-mail  in  the  chain  did  not  include  Abedin  but  b7C 

was  included  in  original  30,524  e-mail  dataset). 

^This  dataset  constitutes  two  backups  made  by  the  Datto  device  on  6/24/13  and  6/29/13  of  the  Pagliano  Exchange  Server. 

^This  dataset  constitutes  two  separate  backups  Justin  Cooper  made  of  Clinton's  BlackBerries  on  4/13/09  and  11/26/11. 

^''Unique"  indicates  the  FBI  reviewed  all  e-mails  in  this  category  to  ensure  they  did  not  contain  duplicates  within  and  across  the  datasets  (i.e.,  if  the  same  email 
appeared  twice  in  the  Datto  Backups  and  once  in  the  Cooper  BlackBerry  backups,  it  was  only  counted  once  instead  of  three  times). 
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Filing  and  Securitv 


Primary  Casa 


CART  CaseTifJe:  MIDYEAR  EXAM; 

r^Jj  MISHANDLING  OF  CLASSIFIED; 

UNKNOWN  SUBJECT  OR  COUNTRY; 
SENSITIVE  INVESTIGATIVE 
MATTER  (SIM) 


37JS5T:?4 


b3 

b7E 


Sari  a I Number: 
Sctiallzad: 


1 

10/15/2015 


Casa  Information 

Subfila:  CART 


TVpe: 

Predication  Source: 


Investigative 

Required 


Owning  Squad:  D5-CD4 


Status:  Pending 


Case  lUTanagare: 


JONATHAN  C 


!l 


Case  Participants:  KABLE  CHARLES  H IV 
JONATHAN  C.  MOFFA 


Robert  Allan  Jones 
COLEMAN  RANDALL  C 
D5-CD4  (SC) 

D5-CD4  fOSTI 


STRZQK  PETER  P II 


hS 

hlC 


CaseAccass:  Prohibited  to  everyone  except  Case  Participants. 

Case  Summary:  FBIHQ,  Counterespionage  Section,  is  opening  a full 

investigation  based  on  specific  articulated  facts  provided  by  an  811 
referral  from  the  Inspector  General  of  the  Intelligence  Coimnunity, 
dated  July  6,  2015  regarding  the  potential  compromise  of  classified 
information- 


Details 

Document TitJa:  [TJ)  Subfile  Opening  Document 


1 of  2 


HRC-2980 

11/2/2015  9:52  AM 
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DATE  Oi-OS-2017  BY  JT^iJlSTSO  KSICC 


FD-302a(Rev,  10-6-95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  10/15/2015 


On  October  15,  2015, 


received  a compact  disk  (CD)  from  FBI  OTD 
containing  photographs  from  a 1 0/3/2015  search  at  an  Equinix  facility  in  Secaucus,  NJ.  The  CD  is 
enclosed  in  an  attached  1 A. 


be 

b7C 


Investigation  on  1Q/Q3/2Q15 at Secaucus.  NJ 


File  # I 

IcART  i-  Date  dictated  N/A 

By 

1 

r 

L 

1 

he 



b7C 

This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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;//MOFORjr 

FEDERAL  BUREAU  OF  INVESTIGATION 


DECLASSIFIED  3Y : NSICG 
Ol'I  D5“18“2D17 


J37JS5T94 


Precedence:  ROUTINE 

To:  INVESTIGATIVE  ANALYSIS  UNIT 

OPERATIONAL  TECHNOLOGY  DIVISION 

To:  CART  FORENSIC  ANALYSIS  UNIT 

OPERATIONAL  TECHNOLOGY  DIVISION 


Date:  10/20/2015 


From: 


Uj 


iUi 


_hashingtqn_eikl 


NVRA,|_ 


D 


Contact : 
Approved  By 
Drafted  By: 


WF  CART 

□ 


SSA 

WFO  CART 

n 

Case  ID  #: 


3 


\- CART  { Pending) 


Title:;p)  MID-YEAR  EXAM; 

MISHANDLING  OF  CLASSIFIED; 

UNKNOWN  SUBJECT  OR  COUNTRY; 

SENSITIVE  INVESTIGATIVE  MATTER  (SIM) 

Synopsis:  To  request  the  assistance  of  the  FBI  Operational 

Technology  Division  (OTP)  Investiaq.tive  Analysis  Unit  (lAU)  in 
support  of  the  casd 


Classifl 
Derived 
)§cTa^ify  On: 


F41M65J 
20401231 


d 20130301 


Administrative:  (U//FOUO)  DO  NOT  UPLOAD.  ENSURE  IT  IS  DISSEMINATED 

ONLY  WITH  A NEED  TO  KNOW  AND  IS  APPROPRIATELY  STORED. 

Details: 

(^/NF)  The  captioned  investigation  is  highly  sensitive  and 
considered  a prohibited  investigation.  Additionally,  the 
investigation  is  designated  a SIM  and  has  an  exemption  for  uploading 


approved  by  AD  Randall  Coleman 


Serial  1) . 


^)S^/-NF)  The  writer  requests  the  assistance  of  the  FBI  Operational 
' Technology  Division  (OTD)  Investigative  Analysis  Unit  (lAU)  to 


b6 

b7C 


b6 

bVC 

b3 

b7E 


b3 

b7E 


b3 

b7E 


T//NOFORN 


HRC-2985 


b3 

bVE 


/HOFCiRN 


conduct  intrusion  analysis  and  malware /virus  analysis  on  the 
following  digital  evidence  in  support  of  case  


• 1B51:  Dell  PowerEdge  R620  server.  Service  Tag:  GXJWFXl 

including  device  itself  and  virtual  machine  files  (with  memory) 
located  on  device 


• 

1B46: 

• 

1B46: 

• 

1B49:  1 

• IB#  TBD  by  WFO  ECC:  Logs  and  events  from  Cloud  Jacket  IDS  device 

• IBS 2 : BlackBerry  cell  phone 

• 1B53:  BlackBerry  cell  phone 

• 1B54:  iPad  Model  A1396 

• 1B45:  Dell  PowerEdge  1950  server  (Blackberry  Enterprise 
Server),  Service  Tag:  5Y5XWB1 

• 1B3:  Dell  PowerEdge  2900,  S/N:  G842PC1 

• 1B2:  Lenovo  ThinkPad  T420  PB-YC912 

• IBl:  Lexar  micron  16  GB  thumb  drive,  1 Lexar  Micron  8 GB  thumb 
drive,  1 Kingston  8 GB  DT  SE9  thumb  drive: 

o Request  for  Malware  Analysis  on  these  devices 

• 1B48:  Datto  Server  882  barcode  C8470FC11M70024  used  for  system 
backups  (cloud  storage  device) 

• 1B44:  Supermicro  server,  S/N:  002590AFDEBE  used  for  system 
backups  (local  storage  device) 


(U//FOUO)  Forensic  images  and/or  copies  of  the  above  media  will 
be  provided  by  the  Computer  Analysis  Response  Team  (CART) 
Headquarters  (HQ)  Forensic  Analysis  Unit  (FAU)  in  Quant ico, 
Virginia. 


(U//F0U0)F 


b7E 


b7E 


(U/ / FOUO ) Contacts  for  this  lead: 


Case  agents:  SSA ^ 

b6 

b7C 


ggMtET//H0F0iaT 


HRC-2986 


WFO  CART; TT  Rnpri  a1  i qh/FoTPriHi  r;  Examiner  (ITS/FE) 


r*apT  Hn Fn-rfangif^  analtrsHc!  Unit:  Supervisory  ITS/FE 


b6 

b7C 


LEAD(s) ; 

Set  Lead  1:  (Action) 

OTP  DP-IAU 

AT  OPERATIONAL  TECHNOLOGY  DIVISION,  INVESTIGATIVE 
ANALYSIS  UNIT 

(U//FOUO]  Attention:  SSa| 

Information  provided  for  action  deemed  appropriate. 

Set  Lead  2 : (Action) 

OTP  DP-FAU 

AT  OPERATIONAL  TECHNOLOGY  DIVISION,  FORENSIC  ANALYSIS 

UNIT 


Examiner 
appropriate . 


fU//FOUO) 


Attention : Supervisory  IT  Specialist /Forensic 
Information  provided  for  action  deemed 


♦ ♦ 
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b7C 


/NOFORN 
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CATE  Dl-OS-2017  BY  JT^JiSTSD  NSICG 


FD-302a(Rev,  10-6-95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  1 1/06/2015 


On  October  3,  2015,  the  following  individuals  from  the  Federal  Bureau  of  Investigation  (FBI) 
participated  in  the  execution  of  an  on-site  search  via  consent  at  Equinix,  Incorporated  data  center 
“Equinix  NY2”  at  275  Hartz  Way,  Secaucus,  NJ  07094: 


I Supi 
jAtti 


Supervisory  Special  Agent  (SSA),  FBI  Washington  Field  Office  (WFO) 
Special  Agent  (SA),  FBI  WFO 
Attorney,  FBI  Office  of  General  Counsel 


[Information  Technology  Specialist  (ITS)/Forensic  Examiner  (FE)  and 


Technical  Program  Manager,  FBI  Operational  Technology  Division  (OTD) 
Computer  Scientist  (CS),  FBI  OTD 


ITS/FE,  FBI  WFO  Computer  Analysis  Response  Team  (CART) 


The  following  individuals  were  also  present: 


b6 

b7C 


Vestigant  LLC 

Katherine  M, " 

’umer,  Esquire,  Williams  & Connolly  LLP 
Project  Manager,  Platte  River  Networks  (PRN) 

b6 

b7C 


Summary: 

The  assistance  of  OTD  and  CART  personnel  was  requested  to  support  the  search  and  seizure  of 
digital  evidence  during  the  execution  of  a Consent  to  Search  at  the  location  referenced  above  on  October 
3, 2015. 


Case  reference:  Case  File  Number 
CART  Submission  ID:  164461 
CART  Service  Request  ID;  75561 

Specimens: 

The  following  computer-related  equipment  related  to  the  PRN  client  “CESC”  was  located  in  the 
Equinix  data  center  “Equinix  NY2”  within  cage  number  00260,  cabinet  number  205,  hereafter  referred  to 
as  the  "CESC  cabinet:  ” 


Investigation  on 
Fileiy 


Bv  ITS/FE 


1Q/Q3/2015 at  Sccaucus,  NJ 


ICART^  7 Date  dictated  N/A 


Tm/FE 

:i  M 1 

This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b3 

b7E 

b6 

b7C 
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FD-302a(Rev.  10-6-95) 


Continuation  of  FD-302  of  On-site  search  at  275  Hartz  Wav.  Secaucus.  NJ  — October  3.  20 1 5.  On  1 1/06/201 5 . Page  2 

1 . PRN  Server:  A Dell  PowerEdge  R620  server,  Service  Tag:  GXJWFXl,  powered  on. 

2.  BlackBerry  Enterprise  Server:  A Dell  PowerEdge  1950  server.  Service  Tag:  5YSXWB1, 
Express  Service  Code  12988372429,  powered  off. 

3.  Seagate  Desktop  USB  external  drive:  A Seagate  Desktop  1 .0  TB  Universal  Serial  Bus  (USB) 
external  drive,  Serial  Number  (S/N):  2GHJ026M,  plugged  in  to  the  PRN  Server, 

4.  Ciseo  NAS:  A Cisco  324  Smart  Storage  Network  Attached  Storage  (NAS)  Device,  S/N: 

QNP141 50082,  plugged  into  Switch  1 and  Switch  2. 

5.  Datto  Server:  A Supermicro  2U  (2  rack  unit)  server,  Model:  S2000,  S/N:  002590AFDEBE, 
Invoice:  482547,  used  for  Datto  backups,  powered  on. 

6.  Cloud  Jacket  Intrusion  Detection  System  tlDSI:  Cloud  Jacket  intrusion  detection  system, 
powered  on. 

7.  Firewall  1 : Fortinet  Fortigate  80C  Security  Appliance  firewall,  located  on  top,  powered  on. 

8.  Firewall  2:  Fortinet  Fortigate  80C  Security  Appliance  firewall,  located  on  bottom,  powered  on. 

9.  Switch  1:  PowerConnect  2824  network  switch,  located  on  top,  powered  on. 

10.  Switch  2:  PowerConnect  2824  network  switch,  located  on  bottom,  powered  on. 

Details: 

At  8:12  AM,  the  individuals  above  entered  the  building  at  275  Hartz  Way,  Secaucus,  NJ 
07094.  Individuals  received  visitor  badges  at  the  front  office  and  entered  the  Inbhv  area  nf  the  Emiiniv 
NY2  data  center  at  approximately  8:22  AM.  At  approximately  8:24  AM 

escorted  the  individuals  above  to  cage  number  00260  and  entered  his  credentials  (biometric  and  pincode 
authentication)  to  open  the  cage  and  cabinet  number  205  located  within  the  cage  where  the  computer 
equipment  was  stored.  At  8:29  AM,  the  individuals  above  exited  cabinet  number  00260  to  return  to  the 
lobby  area  of  the  building  and  begin  the  collection  of  data. 

At  annroximatelv  8:45  AM J Bopped  into  the  PRN  Servei 

using  the  username  “pmadmin”  and  the  password 


PRN  Server  was  done  from 


[started  a new  Microsoft  Word  document  entitled  “On-site  Visif  ’ on  his  laptop  and 

captured  screen  shot  j information  and  datastores.  This  document  was  continually 

updated  throughout  the  collection  process  to  save  information  on  settings,  passwords,  and  configuration 
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data  for  the  network  and  storage  environment.  At  the  end  of  the  collection  process,  the  document  was 
saved! 


At  approximately  8:55  AM,  FBI  OTP  and  CART  personnel  re-entered  the  ''CESC  cabinet''  and 


kvere  saved  to  an  Adobe  Portable  Document  Format  fPDFl  document 
the  Backup  Retention  policy  was  set  to  2 months  and  the 


Backup  Schedule  was  set  to  every  hour.  While  on  site,  after  consultation  with  the  investigative  team,  the 


he 

hic 

b7E 


he 

hlC 

b7E 


b6 

b7C 

b7E 


The  BlackBerry  Enterprise  Server,  Seagate  Desktop  USB  external  drive,  and  the  Datto  Server 
were  removed  from  the  PRN  cage  and  cabinet  and  brought  to  the  Equinix  NY2  lobby  area  for  seizure. 
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At  7: 1 0 PM,  the  search  team  exited  the  Equinix  NY2  data  center. 


Disposition  of  Evidence: 


At  7:03  PM,  the  following  specimens  were  provided  to  the  seizing  agent, 
and  subsequent  transport  to  the  FBI  WFO  Evidence  Control  Center: 


for  storage 


b6 

bVC 


HRC-2994 


HRC-2995 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  11/06/2015 


On  October  8,  2015,  the  following  individuals  from  the  Federal  Bureau  of  Investigation  (FBI) 
participated  in  the  execution  of  an  on-site  search  via  consent  at  Equinix,  Incorporated  data  center 
“Equinix  NY2”  at  275  Hartz  Way,  Secaucus,  NJ  07094: 


Special  Agent  (SA),  FBI  Washington  Field  Office  (WFO) 
,SA,  FBI  WFO 

Computer  Scientist  (CS),  FBI  OTD 
ITS/FE,  FBI  WFO  Computer  Analysis  Response  Team  (CART) 


3 


The  following  individuals  were  also  present: 


[Vestigant  LLC 

Katherine  M.  Turner,  Esquire,  Williams  & Connolly  LLP 

project  Manager,  Platte  River  Networks  (PRN) 


be 

b7C 


be 

b7C 


Summary: 

The  assistance  of  OTD  and  CART  personnel  was  requested  to  support  the  search  and  seizure  of 
digital  evidence  during  the  execution  of  a Consent  to  Search  at  the  location  referenced  above  on  October 
8, 2015. 


Case  reference:  Case  File  Number: 

CART  Submission  ID:  164462 
CART  Service  Request  ID:  75562 

Specimens: 

The  following  computer-related  equipment  related  to  the  PRN  client  “CESC”  was  located  in  the 
Equinix  data  center  “Equinix  NY2”  within  cage  number  00260,  cabinet  number  205,  hereafter  referred  to 
as  the  “CESC  cabinet:  ” 

1.  PRN  Server:  A Dell  PowerEdge  R620  server,  Service  Tag:  GXJWFXl,  powered  on.  The  server 
was  running  the  following  Virtual  Machines  (VM)  in  the  powered-on  state: 


Investigation  on  10/Q8/2015 at Secaucus,  NJ 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b3 

b7E 
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a.  CESC-PRN:  ESXi  Host  server  for  the  “CESC”  network.  Microsoft  Windows  Server  2008 

R2. 

b.  CESC-DCOI : Domain  Controller  for  the  “CESC”  network. 

c.  CESC-EXCHOl:  Exchange  server  for  the  “CESC”  network.  Microsoft  Exchange  2010. 

d.  CLNTINETBB:  BlackBerry  Enterprise  Server  (BES)  for  the  “CESC”  network. 

e.  vCenter:  Centralized  management  for  virtual  machines  and  the  virtual  server  environment. 

2.  Cisco  NAS:  A Cisco  324  Smart  Storage  Network  Attached  Storage  (NAS)  Device,  S/N: 

QNPl  41 50082. 

3.  CloudJacket  Intrusion  Detection  System  (IDS):  Cloud  Jacket  intrusion  detection  system, 
powered  on. 

4.  Firewall  1 : Fortinet  Fortigate  80C  Security  Appliance  firewall,  located  on  top,  powered  on. 

5.  Firewall  2:  Fortinet  Fortigate  80C  Security  Appliance  firewall,  located  on  bottom,  po\vered  on. 

6.  Switch  1:  PowerCormect  2824  network  switch,  located  on  top,  powered  on. 

7.  Switch  2:  PowerCormect  2824  network  switch,  located  on  bottom,  powered  on. 

Details: 


At  10:20  AM,  the  individuals  above,  except  Mrs.  Turner,  entered  the  building  at  275  Hartz  Way, 
Secaucus,  NJ  07094.  Individuals  received  visitor  badges  at  the  front  office  and  entered  the  lobby  area  of 
the  Equinix  NY2  data  center  at  approximately  10:22  AM  to  wait  for  further  instruction  from  the 
investigative  team  and  Mrs.  Turner.  At  approximately  12:20  PM,  the  individuals  exited  the  data  center. 


At  approximately  2:51  PMJ 


b6 

b7C 

b7E 
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At  approximately  6:36  PM. 


shut  down  the  Cisco  NAS.  At  approximately  6:48  PM, 


Jshut  down  the  physical  PRN  Server  and  unplugged  it  from  the  network.  The  PRN  Server 


and  Cisco  NAS  were  removed  from  the  CESC  cabinet  and  cage  and  brought  to  the  Equinix  NY2  lobby 
area  for  seizure. 


b6 

bVC 

b7E 


b6 

bVC 


At  9:00  PM,  the  search  team  exited  the  Equinix  NY2  data  center. 

Disposition  of  Evidence: 

At  approximately  6:50  PM,  the  following  specimens  were  provided  to  the  seizing  agent,  SA 

Ifor  storage  and  subsequent  transport  to  the  FBI  WFO  Evidence  Control  Center: 


2.  Cisco  NAS 

3.  PRN  Server 


be 

b7C 

b7E 


Derivative  Evidence: 


1. 


b7E 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  1/5/20 1 6 


Tn  an  email  dated  January  4,  201 6j  Information  Technology  Specialist/Forensic  Examiner  (ITS/FE) 
Df  the  Federal  Bureau  of  Investigation  (FBI)  Washington  Field  Office  (WFO)  Computer  Analysis 


Response  Team  fCART^  provided  the  following  documents  to  Supervisory  Special  Agents  (SSa|^ 


Kes^ 

and|_ 


1' 


f the  FBI  Cyber  Division 


Cyber  Threat  Analyst,  National  Cyber 


b6 

b7c 


Investigative  Joint  Task  Force  (NCIJTF)  Office  of  Analytical  Assessments  (OAA),  and| 
Information  Technology  Specialist,  Investigative  Analysis  Unit,  Operational  Technolo^  Division: 


1) 


2) 


by  the  Cyber  Division. 


or  further  analysis 


The  attachments  were  burned  to  a CD  and  are  included  in  a 1 A envelope  along  with  a copy  of  the  email 
dated  January  4,  201 6. 


b7E 


b7E 


Investigation  on  1/4/2016  at Washington,  DC 


File# 


JcART--  P?  Date  dictated  N/A 


ByllS/F^ 

This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  it  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  1/13/2016 


In  an  email  dated  January  12,  2016,  Information  Technology  Specialist/Forensic  Examiner  (ITS/FE) 

Jofthe  Federal  Bureau  of  Investigation  (FBI)  Washington  Field  Office  (WFO)  Computer  Analysis 


^ J T J ^ V ^ T*  UrlJ  J J 1 I I ^ tUl  1 J.  J 

Response  Team  (CART)  provided  the  following  dociirnentm  Siinervicnpr  Special  Agents  (SSA][ 
andl  — lofthe  FBI  Cyber  Division,  Sa|  lif  the  FBI  Chicago  Fielf 


Ir.vher  T1 

to  Serial  8 

|c 

if  the  FBI  Chicago  Field  Office,  and 


CrVher  Threat  Analyst,  National  Cyber  Investigative  Joint  Task  Force  (NCIJTF)  in  reference 


CART): 


b3 

b6 

b7C 

b7E 


b7E 


The  file  was  burned  to  a CD  and  is  included  in  a 1 A envelope. 


Reference  Document:  Serial  8 


■CART) 
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Investigation  on  1/12/2016 at Washington^  DC 


File# 


CART  Date  dictated  N/A 


b3 

b7E 


By  ITS/FB 


This  document  contains  neither  recommendations  nor  conciusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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ALL  imVEl.<ATiai-i  COlJTAIt^ED 
HEBEIll  IS  LUICLASSiriED  EXCEPT 
WHEKZ  SBUViU  GTHERV;iSE 


Date  of  transcription  2/8/2016 


On  February  4^  2016,  Information  Technology  Specialist/Forensic  Examiner  (ITS/FE]|  of 

the  Federal  Bureau  of  Investigation  (FBI)  Washington  Field  Office  (WFO)  Computer  Analysis  Rp^nnn^P  Team 
(CART)  provided  a DVD  containing  the  following  documents  to  Special  Agent  (SA)|  of  the  FBI 

Chicago  Field  Office  for  additional  analysis: 


1) 

2) 

3) 

4) 


The  documents  above,  identified  bv  review  case  name,  contain] 

. . I jrhe  DVD  containing  the  files  above  is  enclosed  in  a lA 

envelope  for  inclusion  in  the  case  filC' 


b6 

bVC 


bl 

b3 

b€ 

b7C 

b7S 


b7E 


Investigation  on  2/4/2016  at Washington,  DC 


ICART  Date  dictated 


N/A 


By  ITS/FH 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  propert>'  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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b7E 
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b6 

b7C 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  2/24/2016 


On  February  24,  2016,  Information  Technology  Specialist/Forensic  Examiner  (ITS/FE  bf 

the  Federal  Bureau  of  Investigation  (FBI)  Washington  Field  Office  (WFO)  Computer  Analysis  Response  Team 


(CART)  provided  a DVD  containing  the  following  document  to  Special  Agent  (SA 
Chicago  Field  Office  for  additional  analysis: 


contain 


ins{ 


containing  the  file  above  is  enclosed  in  a 1 A envelope  for  inclusion  in  the  case  file. 


bfthe  FBI 


The  document  above,  identified  bv  the  review  case  name 

i 

rheDVD 

b6 

b7C 


b3 

b6 

b7C 

b7E 


Investigation  on  2/24/2016 
Filei^ 


at 


Washington^  DC 


CART^  [(  Date  dictated  N/A 


Bv  ITS/FH 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  3/4/2016 


On  February  29,  2016,  Information  Technology  Specialist/Forensic  Examiner  (ITS/FE; 


the  Federal  Bureau  of  Investigation  (FBI)  Washington  Field  Office  (WFO)  Computer  Analysis  Resnonse  Team 

A m'x  • j _ j .r-.  ii  . - 1 . ^ ^ I * ‘ ■ I ^ . **  * 


If 


(CART)  provided  the  following  document  to  Special  Agent  (SA)| 
for  additional  analysis: 


]of  the  FBI  Chicago  Field  Office 


The  document  above  contain^ 


□ 


reterenced  m evidence  item  1B67. 


and 


On  March  4,  2016,  ITS/F^ provided  the  following  document  to  S A|  |for  additional  analysis: 


The  document  above  contain  J" 


b6 

b7C 


b3 

b7E 


b6 

b7C 

b3 

b7E 


which  was  provided  to  the  FBI  on  March  2,  2016. 


Two  (2)  DVDs  containing  the  files  above  are  enclosed  in  a 1 A envelope  for  inclusion  in  the  case  file. 
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File# 


CART^l^  Date  dictated 


N/A 


ByllSZEJ 


This  documfeiit  coptains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  2/24/2016 


On  March  28,  2016,  Information  Technology  Specialist/Forensic  Examiner  (1TS/FE)| 


of 


the  Federal  Bureau  of  Investigation  (FBI)  Washington  Field  Olfice  (WFO)  Compute^f  Analysis  Resnopse  Team 
(CART)  provided  a DVD  containing  the  following  documents  to  Special  Agent  (SA 
Chicago  Field  Office  for  additional  analysis: 


bf  the  FBI 


1) 

2) 

3) 


The  documents  above  contain| | 

evidence  item  1B42,  which  is  documented  in  Serial  number  102  in  the  case  file.  The  DVD  containing  the  files 
above  is  enclosed  in  a 1 A envelope  for  inclusion  in  the  case  file. 


from 


b6 

b7C 


b6 

b7C 

b7E 


b6 

b7C 

b7E 


Investigation  on  3/28/2016 

File#  1 hART 


at  Washington,  DC 
Date  dictated  N/A 


By  ]TS/FE| I 

This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  4/19/2016 


bf  the 


On  April  4,  2016,  Information  Technology  Specialist/Forensic  Examiner  (ITS/FE) 

Federal  Bureau  of  Investigation  (FBI)  Washington  Field  Office  (WFO)  Computer  Analv^i^  Tpa~ 

(CART)  provided  a DVD  containing  the  following  documents  to  Special  Agent  (SA)|  of  the  FBI 

Chicago  Field  Office  for  additional  analysis: 


2. 

3. 

4. 

5. 

6. 


Analyst 


On  April  13-  2Q16,  ITS/FE|  [provided  a DVD  containing  the  following  documents  to  Intelligence 


for  additional  analysis: 


L 


hS 

hlC 


b7E 


hS 

hlC 

hlE 


Investigation  on  4/19/2016 at Washington.  DC 


Filei^ 


CART 


Date  dictated 


N/A 


By  ITS/FH 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBL  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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2. 

3. 


bVE 

b7E 


Three  (3)  DVDs  containing  the  files  above  are  enclosed  in  a 1 A envelope  for  inclusion  in  the  case  file. 
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Date  of  transcription  Q5/Q9/2Q16 


On  May  9,  2016,  Information  Technology  Specialist/Forensic  Examiner  (ITS/FE^ 


bf  the 


Federal  Bureau  of  Investigation  (FBI)  Washington  Field  Office  ( WFO)  Computer  Analysis  Resnonse  Team 
(CART)  provided  a DVD  containing  the  following  documents  to  Intelligence  Analyst 
additional  analysis: 


[for 


he 

hlC 


bVE 


A DVD  containing  the  files  referenced  above  is  enclosed  in  a 1 A envelope  for  inclusion  in  the  case  file. 


Investigation  on  05/09/2016 at Washington,  DC 


File# 


CART'*  Date  dictated  N/A 


Bv  ITS/FH 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency'  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  05/13/2016 


On  May  13,  2016,  Information  Technology  Specialist/Forensic  Examiner  (1TS/FE)|  of  the 

Federal  Bureau  of  Investigation  (FBI)  Washington  Field  Office  (WFO)  Computer  Analysis  Response  Team 
fCAR^  provided  a DVD  containing  the  following  documents  to  Intelligence  Analyst  ]^r\d  Special 

Agent  of  the  FBI  Chicago  Field  Office  for  additional  analysis: 


2J 


3J 


he 

hlC 


b7E 


Two  (2)  DVDs  containing  the  files  referenced  above  are  enclosed  in  a 1 A envelope  for  inclusion  in  the  case 

file. 


Investigation  on  05/13/2016 


File# 
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at  Washington,  DC 
. Date  dictated  N/A 


By  JTS/Fd 
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ITiis  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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Date  of  transcription  08/27/20 1 5 


On  August  27.  2015.  Special  Agenj 


States  AttomeM 


physically  served  a subpoena  tol 


]telephonically  contacted  Assistant  United 


of  the  Eastern  District  of  Virginia,  who  provided  that  he 
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he 

hic 

b7E 


The  subDoena  was  accepted  by 

telephone  numbei 

an  behalf  of| 
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n Responsive  Information  to  Your  Legai  Process 


Subject:  RE| 


(WF)  (FBI) 


tesponsive  Information  to  Your  Legal  Process 


Hello, 

Please  find  the  attached  response  to  your  legal  request.  If  you  have  any  questions  regarding  this  production, 
please  reply  to  this  email  and  include  the  Internal  Reference  Number  provided  in  the  attached  letter. 


We  ask  that  vou  submit  all  future  leeal  nrocess  throuelf 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Dale  of  transcription  09/02/20^  5 


(UZ/TOU©-)  issued  in  the  United  States  District 

Court  for  the  Eastern  District  of  Virginia  onF 


served  onf 


1 


was 


pY  email  at 

Immediately  following  the  email  described  above,  the 

" ^^acknowledging  the 

requested  a soft  copy 


writer  received  an  automated  response  from] 

contact.  At  4:09  PM  on  August  31,  2015 

of  the  legal  process.  The  writer  responded  on  September  01,  2015  with 


a . txt  file  containing  only] 
preservation  letter. 


from  the 


b3 

he 

hlC 

b7E 


(u//-peu©^  A copy  of 


and  emails  described  above 


are  attached  to  this  communication  in  an  FD-340. 
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(U/ /POUO)  At  4:43  PM  on  September  01,  2015,  the  United  States 
Attorney's  Office  in  the  Eastern  District  of  Virginia  Tint-ifipri  tbP  FBI 

subpoenas  were  served  tc A copy 

of  the  notification  and  the  subpoenas  are  attached  to  this 
communication  in  an  FD-340, 
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Washington.  DC 
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by  Sa|  I 
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HiibnoRTiaH  tn\ 

1 A copy  of  the  notification  and  the 
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subpoenas  are  attached  to  this  communication  in  an  FD-340. 
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(U/Z-petJ©-)  On  September  4,  2015,  SA 


received 


an  email  from  the  United  States  Attorney's  Office  for  the  Rastern 


District  of  Virginia  containing  a subpoena  response  from 

The  response  is  attached  to  this  communication 


in  an  FD-340. 
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(U//F0U0)  On  September  9,  2015,  SAl 

a Federal  Express  package . tracking  number 

n The  packacfe  contained  f 


1 received 


b3 

b6 

b7C 

b7E 


in  response  to  subpoena 


was  placed  into  evidence . 


is  attached  to  this  communication  in  an  FD-340 , 


Investigation  on  09/08/2015 at  ^ 

File#  I IgJ  -I*!’ 


Washington,  DC 


Date  dictated  09/08/2015 
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an  email  from  the  United  States  Attorney' s Office  for  the  Eastern 
District  of  Vircrinia  containing  a subpoena  response  froml 

The  response  is  attached  to  this  ' 

communication  in  an  FD-340. 
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On  September  9,  2015.  SA 


] received 


(U//fOUO| 

an  email  from| | The  email  and 

attached  files  contained  a supplemental  response  to  subpoena | ~| 


] The  email  and  files  are  attached  in  this 


communication  in  an  FD-340. 
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Date  of  transcription  09/25/2015 


(U//FOUO) 

On  September  24,  2015,  SA 

received 

an  email  fromf" 

Icontaininq  a 

subpoena  response  to 

1 

1 The  response  is  attached  to  this 

communication  in  an 

FD-340  . 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  09/29/2015 


fU//FOtJe)  On  September  28.  2015,  SAI 


received  a letter  fro 


JThe  letter  contained  a response  to  subpoena[ 


i 


indicated  they  were  unable  to  find  any  information  responsive  to 

of  the 


the  request.  A Grand  Jury  Subpoena  Duces  Tecum  Report  was  returned  via  email  d 
U.S.  Attorney’s  Office,  Eastern  District  of  Virginia,  on  9/29/2015.  The  referenced 
attached  to  this  communication  in  a lA. 


b3 

b6 
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letter  is 


Investigation  on  09/28/2015 


at 


Washington,  DC 
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Date  of  transcription  09/29/20 1 5 


rU/ZPOtfO-)  On  September  29.  2015.  SA 


received  a letter  and  Suhnnena 


response  fronj 
and  accompanvinE  documents  vyere  addressed  to 


subpoena] 
via  email 
referenced 


The  letter 

|and  contained  a response  to 
A Grand  Jury  Subpoena  Duces  Tecum  Report  was  returned 
of  the  U.S.  Attorney’s  Office,  Eastern  District  of  Virginia,  on  9/29/2015.  The 
return  is  attached  to  this  communication  in  a 1 A. 
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b6 
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Investigation  on  09/28/2015 


at 


Washington,  DC 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
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This  transmission  may  contain  confidential  information  intended  only  for  the  person(s)  named  above.  Any 
other  distribution,  re-transmission,  conving  or  disclosure  is  strictly  prohibited.  If  you  have  received  this 
transmission  in  error,  please  notifi  immediately  and  delete  this  file/message  from  your 

system. 


-GU  - IQ, 


HRC-3091 
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Fmiwf 


htJE)  (FBI)" 


Date 
ToJ 
Cc 


(WF)  (FBI)" 


To  Whom  It  May  Concern, 


In  the  response  below,  infornnation  for  the  subpoena  regarding  \s 

provided.  While  the  email  cites  the  legal  request  for  information  fori 


have  received  no  correspondence  with  regard  to  that  request.  Please  confirm  that 
information  is  forthcoming. 


Sincerely, 
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b6 

b7C 
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I 

Federal  Bureau  of  Investigation 
Washington  Field  Office 
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b7C 
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b7C 


Fromj 

Sena 


To:| 

Subject^ 


IfWFUFBIl 


Via  Email  Delivery 


Special  Agen| 

United  States  Attorney’s  Office 
Eastern  District  of  Virginia 
Alexandria  Division 
Alexandria,  Virginia 


Dear  Special  Ageni 


Or  received  a legal  request  for  information  relating  to| 

1 After  a reasonable  search  of  our  records,  no 

information  was  found  foj 

This  information  was  prepared  byl 


tn  the  ordinary  course  of 


business  and  was  obtained  during  a reasonable  search  of  our  records  based  on  the 
information  provided  to  us  for  identification. 


Regards, 


b3 
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This  transmission  may  contain  confidential  information  intended  only  for  the 
person(s)  named  above.  Any  other  distribution,  re-transmission,  copying  or 


disclosure  isstrictl 
please  notify 
from  your  system. 


pu  have  received  this  transmission  in  error, 
immediately  and  delete  this  file/message 
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(TJ//FOUO)  On  October  5,  2015,  received  a letter  and  Subpoena  response 

fromi 

|The  response  was  in 

reeards  to  subnoena 

A Grand  Jury  Subpoena  Duces  Tecum  Report  was 

returned  via  email  to 

jf  the  U.S.  Attorney’s  Office,  Eastern  District  of  Virginia,  on 

1 0/5//20 1 5.  The  referenced 

is  attached  to  this  communication  in  a 1 A. 

Investigation  on  1 0/5/20 15 


File# 


at 


-_n 


Washington,  DC 

Date  dictated  N/A 
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Date  of  transcription  10/06/2015 


fUZ/fetJO)  On  October  2,  2015,  SA\ 


attachments  to 
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rrhe  email  frorH 


? 

Jcc 


eceived  an  email  from 


returned  via  email 
10/06/2015.  The 


iTtJ 

;refi 


ubsequently  forwarded  said  email  and 
contained  a letter  response  to  subpoena|jj 

|A  Grand  Jury  Subpoena  Duces  Tecum  Report  was 

|d  f the  U . S ■ Atto  mey  ’ s Office,  Eastern  District  of  Virginia,  on 


b3 

b6 
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erencec 


mail,  letter,  and  attachments,  are  maintained  in  a 1 A. 


Investigation  on  10/02/201 5 at  _ 

File#  1 bj  ~ C9 


Washinpton>  DC 


Date  dictated 


N/A 


ByS4 
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Jreceived 


(U/;¥QyQj  On  October  8, 2015,  SA| 

I The  letter  which  was  faxed  to  the| 
forwarded  via  email  to  SA | contained  a response  to  subpoena] 


a letter  ffonJ 


(US AO/ED VAl  and  subsequently 


Grand  Jury  Subpoena  Duces  Tecum  Report  was  returned  via  email  to| 

Office,  Eastern  District  of  Virginia,  on  October  8,  201 5.  The  referenced! 
communication  in  a 1 A. 


1 of  the  U ■ S . Attorney  ’ s 
lis  attached  to  this 


b3 

b6 

b7C 

b7E 


Investigation  on  10/8/2015 


File# 


at 


nil 


Washington.  DC 

Date  dictated  N/A 


BySjj  ^ 

This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency,  ^ 


b3 

b7E 

b6 

b7C 


HRC-3099 


HRC-3100 


ALL  FBI  IlJFOftllATiaJ  COWTAIl^EB 

HE.RJEIl'1  IS  Ul'JCLASSiriiC 

DATE  12-22-201^;  BY  JT^JiSTSO  HSICC 


FD-302a(Rev.  10-6-95) 


-1- 


FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  10/14/2015 


rt  I On  Ontnher  1 4.  70 1 S.  S A 1 

received  a FedEx  package  from[ 

Gubsequently  forwarded  said  package 

The  package  froirl 


pacKage  irorq 

JThe  letter  indicated 


contained  a letter  response  to  subpoena 


b3 

he 

hlC 

b7E 


[does  not  have  any  responsive 


documentation  to  the  request^ 

A Grand  Jury  Subpoena  Duces  Tecum  Report  was  returned  via  email  tJ 


the  U,S,  Attorney’s  Office,  Eastern  District  of  Virginia,  on  10/14/2015,  The  referenceq 
letter  is  maintained  in  a 1 A. 


Ll 


Investigation  on  10/14/2015 


at 


Washington.  DC 


b3 

b7E 

b6 

b7C 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI,  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency,  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


HRC-3101 


b6 

b7C 


ALL  FBI  IHFOBMATIDI^  CCIJTAIWEC 

HZHZIM  IS  UllCLASSIFIED 

DATE  12-22-201^.  BY  31^:312120  USIC 


FD-302a(Rev.  10-6-95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  10/15/2015 


gj/ZPOyg^  On  October  15.  2015.  SaT 


subpoenal 


Irhe  mckage  fronT 


contained  a letter  and| 
The  letter  tndicatecj 


_ received  a FedEx  package  from 
Subsequently  forwarded  said  package  to  SA 
I in  response  to 


Representing  to  the  aforementioned  subpoena.  A 

n i.  JT!T^  j.J  r t c a 


Grand  Jury  Subpoena  Duces  Tecum  Report  was  returned  via  email  tc| [of  the  U.S*  Attorney’s 

Office,  Eastern  District  of  Virginia,  on  10/15/2015.  The  referenced  tetter  and|  ^e  maintained  in  a lA. 


b3 

b6 

b7C 

bVE 


Investigation  on  1Q/15/2Q15 


File?^ 


to 


at 


Washington.  DC 

Date  dictated  N/A 


ByS^ 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b3 

b7E 

b6 

b7C 


HRC-3103 


b6 

bVC 


HRC-3104 


A.LL  FEI  IWrORMATIOM  COWTAIIOEE 

HEREIII  15  Ul'ICLASSiriED 

CATE  12-22-COl^  BY  JT^JISTSD  ACC 


FD-302a(Rev,  10-6-95) 


FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  1Q/19/2Q15 


subsequently  forwarded  said  package  to  [The  package  from| 

contained  a letter  anij  |in  response  to  subpoenal 

letter  indicatedi  |6n  1 0/19/20 1 5,  SA|  :ontacted|  who 

provided A Grand  Jury  Subpoena  Duces  Tecum  Report  was 

returned  via  email  td  bf  the  U.S.  Attorney’s  Office,  Eastern  District  of  Virginia,  on 

10/19/2015.  The  referenced  letter  and|  maintained  in  a lA. 


Investigation  on  10/16/2015 

File#  I IgJ 


Washineton^DC 


Date  dictated  N/A 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency,  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


HRC-3105 


b6 

b7C 


HRC-3106 


FD-302a(Rev.  10-6-95) 


ALL  FBI  IRFOBliATia;  CONT^II^C 

HEREIN  IS  UT^CLASSiriEC 

DATE  12-22-2016  BY  J7€JiSTS0  N3ICG 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Dale  of  transcription  10/19/20)5 


rU/ffePCDOn  October  19,  2015,  3k[_ 


indicated 


P' 

Jconta 


ubsequently  forwarded  sftid  jjacj’^aga  to . S 
ontained  a letter  in  response  to  subxrenai 


Received  a UPS  package  ffoni 


was  unable  to  locatd 


The  package  from 
The  letter 


nested  with  the  mtormation  provided 

■ 1 j . 1 T T 


of  the  U.S. 


A Grand  Jury  Subpoena  Duces  Tecum  keport  iv^is  retuoiea  via  email  to| 

Attorney’s  Office^  Eastern  District  of  Virginia,  oh  l0/t9/2(jH|  The  referenced  letter  is  maintained  in  a 
lA, 


b3 

b6 

b7C 

bVE 


Investigation  on  10/19/2015 


at 


Washington^  DC 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b3 

b7E 

b6 

b7C 


HRC-3107 


HRC-3108 


ALL  F3I  IHFOR5.1ATiaiJ  Cni'JTAIl'IED 


HEREin  15  Ui;CLAS3IFIEC 

CATE  12-22-2015  BY  J75J1STS0  IJSICG 


FD-302a(Rev.  10-6-95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  10/19/2015 


(U//FQUO)  On  October  19,  2015,  SA^ 


[subsequently  forwarded  said  package  to 
Jontained  a response  to  subpoend 


"Received  a FedEx  package  fronj 
~|The  package  from 


Tecum  Report  was  returned  via  email  td 


\A  Grand  Jury  Subpoena  Duces 
of  the  U.S.  Attorney's  Office,  Eastern  District  of 


Virginia,  on  10/19/2015.  The  referenced  subpoena  return  is  maintained  in  a lA. 


b3 

he 

bVC 

b7E 


I 


Investigation  on  10/19/2015 at Washington.  DC 

File#  J |gj  Date  dictated  N/A ^3 

b7E 


b6 
b7C 

This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


By  4 


HRC-3109 


hS 

bVC 


HRC-3110 


ALL  F5I  Il’irOftllATIQl'I  COMTAIl'JEB 

HEBZIN  IS  UIICLASSiriED 

CATE  lC-22-201^  BY  JT^JiSTSO  MfSICC 


FD-302a{Rev.  10-6-95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  1 0/22/20 1 5 


rUZ/FG^)  On  October  22.  2015.  SAI 


forwarded  said  package  to 
subpoenal 


via  emai  

referenced  subpoena  return  is  maintained  in  a 1 A. 


received  a FedEx  package  from 
subsequently 


The  package  iron  |contained  a response  to 


^ A Grand  Jury  Subpoena  Duces  Tecum  Report  was  returned 

of  the  U.S.  Attoniey’s  Office,  Eastern  District  of  Virginia,  on  10/19/2015.  The 


b3 

be 

b7C 

bVE 


Investigation  on  10/22/2015 


at 


Washington,  DC 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b3 

b7E 

b6 

b7C 


HRC-3111 


b6 

b7C 


HRC-3112 


ALL  FBI  imORlLh'TlDU  CO’ITAIHEC 

HZHZIN  IS  ™CLASSIFIED 

DATE  12-22-201^..  BY  JT^iJlSTSO  USIC 


FD-302a(Rev,  10-6-95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  1Q/23/2Q15 


from 


nTffPfH-tQ^Onnf'.tnhpr?^  901^  s/ 


~i-prpivpfl  a letter  and  Siihnnprm  response 


response,  which  was  addressed  to  SA 


was  in  regards  to  subpoenf" 


A Grand  Jury  Subpoena  Duces  Tecum  Report  was  returned  via  email  tot 
U.S.  Attorney’s  Office,  Eastern  District  of  Virginia,  on  10/23//2015.  The  referenced^ 
attached  to  this  communication  in  a 1 A. 


Jihe. 


the 


ns 


b3 

b6 

b7C 

b7E 


Investigation  on  1 0/23/20 1 5 


at 


Washington,  DC 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBL  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b3 

b7E 

b6 

b7C 


HRC-3113 


b6 

b7C 


ALL  FEr  imOBlLk.’TlDU  COITAIHEC 

HSRZIN  IS  UUULASSIFIED 

DATE  12-22-2D16  BY  J76J1STS0  HSIC 


FD-302a(Rev.  10-6-95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  10/26/2015 


On  October  23.  2015. 

in  the  form  oi 


received  a letter  and  Subpoena  response, 


The  response  was  provided  b)| 


response,  was  in  regards  to  subpoena 


email  icj  ' 


referenced 


A Grand  Jury  Subpoena  Duces  Tecum  Report  was  returned  via 
loi  me  u.5>  AHomev's  Office,  Eastern  District  of  Virginia,  on  10/26//2015,  The 


ps  attached  to  this  communication  in  a lA. 


b3 

b6 

bVC 

b7E 


b3 

b6 

b7C 

b7E 


Investigation  or  1 0/23/20 1 5 


at 


Washington^  DC 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBIh  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b3 

b7E 

b6 

b7C 


HRC-3115 


b6 

b7C 


XLL  F3I  IMFORllATi™  COmKllTEB 

HEREIN  15  Ul'JCLASSIFIED 

CATE  12-22-201^  BY  JT^JiSTSD  NSICG 


FD-302a{Rev.  10-6-95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcriplioti  1 1/9/2015 


fromT 


On  November  9,  2015, 


The  package  froij 


Isubsequently  forw^ed  said  package  to  S 


Contained  a letter 


eceived  a Certified  M; 


The  letter  indicatet 

IvQuld  be  provided  in  a later  package.  On  1 1/12/2015.  SaI 


in  response  to  subpoena 


b3 

b6 

b7C 

b7E 


Report  was  returned  via  email  t(| 

The  referenced  letter  anj  maintained  in  a 1 A. 


^received  information  indicating 


A Grand  Jury  Subpoena  Duces  Tecum 

jof  the  U.S.  Attorney’s  Office,  Eastern  District  of  Virginia. 


Investigation  on  1 1/9/2015 


at 


Washington,  DC 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBL  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b3 

b7E 

b6 

b7C 


HRC-3117 


b6 

b7C 


ALL  FEI  COITAIIJEE 

HEREIH  IS  tniCLASSIFIED 

DATE  12“22““2016  BY  J76J18TS0  NSICG 


FD-302a(Rev.  10-6-95) 


FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  1 1/12/2Q15 


(U/ffetfO)  On  November  12,  2015,  SA 

received  a FedEx  package  from 

1 Isubsequentlv  forwarded  said 

package  to  I he  package  troid 

pontained  a letter  ancj  | 

1 Im  resDonse  to  subooenal 

The  letter 

indicate!^ 

in 

response  to  the  subpoena.  A Grand 

Jurv  Subnoena  Duces  I'ecum  Report  and 

|was  returned  via  email  to 

maintained  in  a 1 A. 


]of  the  U.S.  Attorney’s  Office,  Eastern  District  of  Virginia.  The  referenced  letter  an  a are 


b3 

b6 

bVC 

b7E 


Investigation  on  1 1/12/201 5 


at 


Washington,  DC 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b3 

b7E 

b6 

b7C 


HRC-3119 


HRC-3120 


ALL  .FBI  IHFORHATiaT  CQNTAIl'IEB 

HEREll}  IS  Ul-JCLASSIFIED 

CATE  12“22“201'S  BY  J7<Sl71STSD  NSICG 


FD-302a(Rev.  10-6-95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  1 l/t7/2Qt5 


r 


On  November  17. 2015.  SAI 


li 


received  a FedEx  package  from. 


opened  the  package  which  contained  a letter  andT 

in  response  tn  snhnnet^f 


indicateq 

Jury  Subpoena  Duces  Tecum  Report  was  returned  via  email  tcf 


iThe  letter 


Eastern  District  of  Virginia.  The  referenced  letter  and)  ^e  maintained  in  a lA. 


In  response  to  the  subpoena.  A Grand 

of  the  U.S.  Attorney’s  Office, 


b3 

b6 

bVC 

b7E 


Investigation  on  1 1/17/2015 


at 


Washington.  DC 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b3 

b7E 

b6 

b7C 


HRC-3121 


hS 

bVC 


HRC-3122 


ALL  INFOFmTIOn  CQIITAII'IEL 

HiRZlM  IS  ™CLASSrFIED 

DATE  12““22“20:6  BY  J7e;JlST80  MSIC 


FD-302a(Rev,  10-6-95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  1 1/23/2015 


fU//FOUe-)  On  November  23,  2015,  FoA^ 


mefl 


nprovided 


at  his  place  of  employment  located  at  

1 constituting  a supplemental  response  to  subpoena  # 


b3 

b6 

b7C 

b7E 


^re 


maintained  m a 1 A, 


Investigation  on  1 1/23/201 5 at Bethcsda,  MD 


File# 


Igj  - 3 2^ 


Date  dictated  N/A 


By  FoaI 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency 


b3 

b7E 

b6 

b7C 


HRC-3123 


b6 

b7C 


HRC-3124 


ALL  JBI  IHFQRi^LilTIDH  CGI^TAII^EC 

HEREIN  IS  Ul^C  LAS  SIFTED 

DATE  12“22““2016  BY  J76J1STS0  NSIC 


FD-302a  (Rev.  10-6-95) 


-I- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  12/1/2015 


(u/ffew©)  On  November  25,  2015, 


front 


cqi 

~|  which  he  subsequently  forwarded  to  S/| 
Jcontained  an  attachment/letter  response  to  subpoena[ 


received  an  email  from 


referenced  email  and  letter  are  maintai 
also  returned  via  email  tol 


iThe  email 

]The 


ed  in  a 1 A.  A Grand  Jury  Subpoena  Duces  Tecum  Report  was 
f the  U.S.  Attorney’s  Office,  Eastern  District  of  Virginia. 


b3 

b6 

b7C 

bVE 


Investigation  on  1 1/25/201 5 


File^ 


Washington.  DC 


Date  dictated  N/A 


By  SA^ 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b3 

b7E 

b6 

b7C 


HRC-3125 


b6 

b7C 


HRC-3126 


ALL  FBI  lUFORLlATiaJ  COWTAIl'TSB 

HE.RJEIH  IS  Ul'JCLfitSSIFIiC 

DATE  12-22-201^;  BY  J75J1STS0  HSICC 


FD-302a(Rev.  10-6-95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  12/1 1/2015 


saT 


aT//F0W)^  On  December  8.  2015.  FoAI 


fromr 


received  a Federal  Express  package  sent  to 


I he  package  tironl 


b3 

b6 

b7C 

b7E 


InHiratf^rT 


Inmyided  was  in  response  to 


The  response  froTT£ 


as  well  as  a copy  of  the  original  subpoena  and  the  associated  Grand 


Jury  Subpoena  Duces  Tecum  Report  - returned  via  email  on  December  9 to 
Attorney's  Office^  Eastern  District  of  Virginia-  are  maintained  in  a lA. 


bftheU.S. 


b3 

hS 

hlC 

b7E 


Investigation  on  12/8/2015 
File  # _\  |GJ 


at Washington.  DC 


Date  dictated  N/A 


b3 

b7S 


By  ¥qM  



This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b6 

b7C 


HRC-3127 


HRC-3128 


ALL  TBI  IHFOKLiATIOll  COITAIIJEC 

HZRilM  IS  UIJCLASSIFIED 

DATE  12“22““2016  BY  J76J13TS0  IJSICQ 


FD-302a(Rev.  10-6-95) 

-It  i 

FEDERAL  BUREAU  OFjNVESTIGATION 


Dale  of  transcription  12/15/201 5 


fUZ/FOUO)  Oil  December  15,  2015,  Sj 

received  a UPS  letter  fron 

b3 

he 

b7C 

|The  letter,  which  was  addressed  to 

contained  a 

response  to  subpoen£| 

in  whiclj 

indicated  they  were  unable  to 

b7E 

find  any  information  responsive  to  the  request.  A Grand, Jury  Subpoena  Duces  Tecum  Report  was 
returned  via  email  td  Inf  the  US.  Attorney’s  Office,  Eastern  District  of  Virginia,  on 


December  1 5,  201 5,  The  referenced letter  is  attached  to  this  communication  in  a 1 A. 


Investigation  on  12/15/2015 


at 


Washington,  DC 


b3 

bVE 

b6 

b7C 


This  documeni  contains  neither  recommendations  nor  conclusions  of  the  KBf  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


HRC-3129 


b6 

b7C 


HRC-3130 


A.LL  F3I  imomiATlW  aDmXllTEB 

HEREin  IS  Ul'JCLASSiriED 

CATE  12-22-201^  BY  JT^JiSTSD  NSICG 


FDO02a{Rev.  10-6-95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  12/21/2015 


r 


fU/ZrOUQ)  On  December  21 . 201 5.  S/T 


subpoenal 
email  to 


The  referenced 


received  a letter  and 

The  letter  andl  Iwhich  were  mailed  to  S A 

land  subsequently  forwarded  via  email  to  S/i|  Icontained  a response  to 


b3 

b6 

b7C 

b7E 


5 I A Grand  Jury  Subpoena  Duces  Tecum  Report  was  returned  via 

f the  U.S.  Attorney  s Office,  Eastern  District  of  Virginia,  on  December  21,  2015. 
letter  is  attached  to  this  communication  in  a 1 A. 


> 


b3 

b7E 


Investigation  on  12/21/2015 


at 


Washington,  DC 


b3 

b7E 

hS 

hlC 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


HRC-3131 


b6 

b7C 


ALL  FE-I  CaiTAIIJED 


HZRZIM 


IS  UNCLASSIFIED 


DATE 


12“22““2016  BY  J76J18TS0  tlSICG 


FD-302a(Rev.  10-6-95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  12/22/2015 


contained  a response  to  subpoenal 
request  for  information  pertaining 


On  December  2^^  2015,  SA|  Received  a UPS  letter  ffon| 

The  letter,  which  was  addressed  to  S/j 


conversation  with  Forensic  Account 


email  t<| 

The  reference^ 


responded  to  the 


b3 

b6 

bVC 

b7E 


that  they  were  unable  to  locate 


but  indicated  in  a phone 


A Grand  Jury  Subpoena  Duces  Tecum  Report  was  returned  via 
|of  the  U.S-  Attorney's  Office,  Eastern  District  of  Virginia,  on  December  22,  2015, 


letter  is  attached  to  this  communication  in  a lA, 


Investigation  on  12/21/2015 


at 


Washington,  DC 


b3 

b7E 

b6 

b7C 


Thin  document  contains  neither  recommendations  nor  conclusions  of  the  KBL  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  12/22/201 5 


On  Decembe^l.  2015,  SA  Ireceiyp^  f^mail 

Trhe  email-  which  was  addressed  tn  sJ 


indicated  they  did 


response  to  subpoena  | 

not  have  information  responsive  to  the  request.  A Grand  Jury  Subpoena  Duces  Tecum  Report  was 
returned  via  email  tq )f  the  TJ.S.  Attorney’s  Office,  Eastern  District  of  Virginia,  on 


bontained  a 


December  22,  2015.  The  referenced  email  and  attachment  are  attached  to  this  communication  in  a lA. 


b3 

b6 

b7C 

b7E 


Investigation  on  12/21/2015  at 

File#  J IgJ  - 3 ^ 


Washington.  DC 


Date  dictated 


N/A 


ByS^ 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b3 

b7E 

b6 

bVC 


HRC-3135 


b6 

b7C 


HRC-3136 


;^LL  TBl  irJTORlfATiai  COI'TTAII^D 

HEREIN  IS  OTCLASSIFIEC 

D^TE  12-22““201‘£  BY  J7€JiSTS0  N3ICG 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  12/23y20l5 


(U//Fe¥0)  On  December  23,  2015,  SJ 


received  a UPS  package  containing  a 


letter  anc 


A Grand  Jury  Subpoena  Duces  Tecum  Report  was  returned  via  email  t 


of  the  U.S. 


Attorney’s  Office,  Eastern  District  of  Virginia,  on  December  23,  201 5,  The  referenced  etter  and 

are  attached  to  this  communication  in  a 1 A. 


Investigation  on  12/23/2015  at Washington,  DC 


Date  dictated  N/A 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  he  distributed  outside  your  agency. 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  1/12/2016 


r 


rU/ffewmOn  January  12.  2016.  SA 


jin  response  to  subpoena 


Tecum  Report  was  returned  via  email  tq 

Virginia,  on  January  12,  2016.  The  referenced  emait 


h-eceiyed  an  email  fforwarded  bv  SA 
I The  email  containedi  ~l 

|a 


Grand  Jury  Subpoena  Duces . 
of  the  U-S-  Attorney’s  Office,  Eastern  District  of 

are  included  in  a 1 A. 


b3 

b6 

b7C 

bVE 


Investigation  on  1/12/2016 at . 

Igj  - Mo 


Washington,  DC 


File# 


Date  dictated 


N/A 


By^ 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI,  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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hS 
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b6 

b7C 


HRC-3140 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  1/19/2106 


fronf 


(V//¥me^  On  January  12.  2016.  SM 


The  response  was  forwarded  to  SA 


jreceived  a letter  ^d  Subpoena  response 
|by  SA| 


b3 

b6 

b7C 

b7E 


(UZ/FOUej  [also  providecf 


b3 

b7E 


(U//rOUO)  A Grand  Jury  Subpoena  Duces  Tecum  Report  was  returned  via  email  td 
of  the  U>S.  Attomev^s  Office,  Eastern  District  of  Virginia,  on  1/19/2015,  The  referenced” 
|2ind  is  attached  to  this  communication  in  a 1 A, 


b3 

b6 

b7C 

b7E 


b3 

b7E 


Investigation  on  1/19/2Q16 at  _ 

GJ  - 


Washington.  DC 


File# 


Date  dictated 


N/A 


BySA 


b3 

b7E 

b6 

b7C 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBL  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  1/19/2106 


from 


fU//FOUO)  On  January  19.  2016.  S/nT 


was  forwarded  to  SAf 


fcySA^ 


a Iffttffr  and  Siihnn^na  response 

The  response 


(U//FOU0)  A Grand  Jury  Subpoena  Duces  Tecum  Report  was  returned  via  email  tol 
of  the  U.S.  Attorney’s  Office,  Eastern  District  of  Virginia,  on  1/19/2015.  The  referenced! 


land  is  attached  to  this  communication  in  a 1 A, 


□ 


b3 

b6 

b7C 

bVE 

b3 

b6 

b7C 

b7E 


b3 

b7E 


Investigation  on  1/19/2016 


at 


Washington,  DC 


b3 

b7E 

b6 

b7C 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  1/28/2016 


letter  ant^ 
contained, 
f letter  and 


h On  December  2^.  701 S.  SAI a T ipfi  package  containing  a 

I I I The  paclpne I 

ise  to  subpoena  A previous  response  fron 

Sj^re  submitted  to  the  tile  in  serial  39  of  captioned  investigation/subfile.  Tne  reterencec 
^e  attached  to  this  communication  in  a 1 A. 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  2/4/20 1 6 


fU//TOUO)  A Grand  Jury  Subpoena  Duces  Tecum  Report  for  both  returns  were  sent  via  email  to 

lofths  U,Si  Attorney's  Office^  Eastern  District  of  Virginia,  on  2/4/2016*  The  referenced 

and  are  attached  to  this  communication  in  2 separate  1 As. 


b3 

bVE 


b7C 


^rhis  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  2/10/2016 


response  froml 


(U//fOtJO)  On  February  5,  2016,  SA 


received  a letter  and  Subpoena 


(U//rOUO)  A Grand  Jury  Subpoena  Duces  Tecum  Report  Avas  returned  via  email  ^ 
of  the  Attomey^s  Office,  Eastern  District  of  Virginia,  on  2/10/2016.  The  referenced! 


^d  is  attached  to  this  communication  in  a 1 A. 


b3 

he 

hic 

b7E 


Investigation  on  2/1Q/20I6 at  Washington.  DC 

^ Date  dictated  N/A 


By^ 


This  document  comainsneitherrecommendationsnorconclusions  of  the  FBI.  H is  the  property  of  the  FBI  and  is  loaned  to  your  agency  it 

and  Its  contents  are  not  to  be  distributed  outside  your  agency,  ^ 


b3 

b7E 

b6 
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HRC-3150 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  2/1 1/2016 


fU//FQBO)  On  February  10,  2016,  S/\ received  an  email  from| 

The  email,  which  was  originally  sent  to  Sy^l  bnd  subsequently 


I ~ I ? 

forwarded  to  SA pontained  a response  to  subpoena 

Jury  Subpoena  Duces  Tecum  Report  was  returned  via  emailtal 
Eastern  District  of  Virginia,  on  February  1 1,  2016.  The  referenced! 
attached  to  this  communication  in  a 1 A, 


A Grand 


Jof  the  U.S.  Attorney’s  Office, 
Jemail  and  response  are 


b3 

be 

b7C 

b7E 


Investigation  on  2/1 1/2Q16 


at 


Washington,  DC 


b3 

b7E 

b6 

b7C 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  it  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


HRC-3151 


b6 

b7C 


HRC-3152 


(Rev.  05-01-2008) 


GECLAS3IFIEC  BY;  N5ICG  J37JS5T54 
DU  05'"lS"20i7 


FEDERAL  BUREAU  OF  INVESTIGATION 


Precedence:  ROUTINE 


Date:  2/17/2016 


To:  Washington  Field 


iUi 


From:  Washington  Field 

CI-13 

Contact:  FoA 


Approved  By: 
Drafted  By: 

Case  ID  #:  J;i^//I«i) 


GJ  - VT 


Title:  .tj,  MIDYEAR  EXAM; 

MISHANDLING  OF  CLASSIFIED; 

UNKNOWN  SUBJECT  OR  COUNTRY; 

SENSITIVE  INVESTIGATIVE  MATTER  (SIM) 

FEDERAL  GRAND  JURY  MATERIAL  - DISSEMINATE  PURSUANT  TO  RULE  € <E) 

Do  not  disseminate  except  as  authorized  by  federal  rule  of  criminal 
procedure  6(e). 


be 

b7C 


b3 

b7E 


b3 

b7E 


b3 

b7E 


Enclosure  (s)  : , 

1,  (U//-FOUO^  Referenced^ 


Details : 

(U)  Background  ^ 

(U//FOUO)  In  July  2015,  the  FBI  initiated  the  captioned  investigation 
based  on  an  811  referral  from  the  Inspector  General  for  the 
Intelligence  Community  (ICIG)  regarding  the  possible  compromise  of 
classified  national  security  information. 

{U//FOU©)  The  potential  compromise  was  identified  when,  as  part  of 
a Freedom  of  Information  Act  (FOIA)  request,  the  U.S.  Department  of 


S 


/HOFORN 


HRC-3153 


{Rev.  05-01-2008) 


FEDERAL  BUREAU  OF  INVESTIGATION 


state  (DoS)  Office  of  Inspector  General  and  the  ICIG  were  reviewing 
electronic  mail  communications  from  a private  server  previously  used 
by  a State  Department  official  during  their  tenure  at  DoS.  An  initial 
review  of  this  material  identified  several  emails  containing 
classified  national  security  information  some  of  which  was  Top 
Secret . 

(U//F©e©^  was  identified  as  being  involved  with  the 

operation  of  this  server  and  associated  hardware  {"the  server") . 


b6 

b7C 


HRC-316i 
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FEDERAL  BUREAU  OF  INVESTIGATION 


J 

Date  of  transcription  2/24/2016 


('UZ/FOLIO)  On  Febmaiv  23,  2016.  S/J 

■eceived  an  email  fronl  | 

kvhich  was  originally  received  bv  SaI 

[The  email  contained 

in  response  subpoena 

A Grand  Jury  Subooena  Duces 

Tecum  Report  was  returned  via  email  tq 

of  the  U.S.  Attorney’s  Office,  Eastern  District  of 

Virginia,  on  February  24,  2016.  The  reierencet^ 

smail  ancT 

are  attached  to  this 

b3 

b6 

b7C 

b7E 


Investigation  on  2/23/2016 at Washington.  DC 

file  # _J  |gj  Date  diaated  N/A 


ByS^ 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency.. 


b3 
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b6 
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HRC-3162 


b6 

b7C 


ALL  FBI  INFORilATiaJ  -COt-JTAIl'IED 

REREm  IS  ™CLASSIFIEC 

CATE  12-22-201€^  BY  J76J1STS0  l^SICG 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  03/01/2016 


nJ//FOliQj  On  February  12,  2016,  SA| 


iThe  email  contained" 


received  a series  of  emails  from 

las  an  arlriitinnal  trj  subpOCna| 


ptating 

could  be  located.  A Grand  Jury  Subpoena  Duces  Tecum  Report  was  returned  via  email  tg 
the  U.S.  Attorney's  Office,  Eastern  District  of  Virginia,  on  December  22,  2015  by  SJ\ 

Uere  enclosed  in  a 1 A* 


Btating  no  records 


]Qf 


b3 

b6 

b7C 

b7E 


investigation  on  2/12/2016 


at 


Washington^  DC 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b3 

b7E 

hS 

hlC 


HRC-3164 


a 


hS 

bVC 


T//ORGON/NQFORW 


:ECLASSiriEC  BY: 
□W  05“lS“20i7 


IISICC  J37JS5T54 


FEDERAL  BUREAU  OF  INVESTIGATION 
Electronic  Communication 


Precedence:  ROUTINE  Date:  03/01/2016 

To:  Washington  Field 


From:  Washington  Field 


Title:  MIDYEAR  EXAM; 

MISHANDLING  OF  CLASSIFIED; 

UNKNOWN  SUBJECT  OR  COUNTRY; 
SENSITIVE  INVESTIGATIVE  MATTER  (SIM) 


b6 

bVC 


b3 

b7E 


iUi 


Synopsis:  (U)  To  submit  a DVD  containing  subpoena  email  to  the  file. 


iUi  (X/MFS 


Derived  From 
D ec  1 as*tfir'Ori : 


F361^ 

JJ^SCG  20090615 
204103B: 


(U) 


Full  Investigation  Initiated:  07/10/2015 

Detailg- 


On  February  1 6 

ike 


L2ILL6_  in  consultation  with  SSA 

burned  emails  containina 
a reg|?<:>nsea-4:o  a DVI)^  This  action  was  taken 


due  to  the  fact  that  S 


unclassified  account  reached  the 


^ ^ T I o j-  j-  ^ OUii  L ± 

maximum  size  limit  ana  could  no  longer  send  email.  The 
aforementioned  DVD  is  attached  to  this  communication  as 


a lA. 


b6 

b7C 


♦ ♦ 


Du  NuL  Upload- 


!T//oncoH/MOFonir 


HRC-3166 


b6 

b7C 


HRC-3167 


A.LL  T'Bl  IHFOmiATIClJ  COWTA-IIIED 

HEREIN  IS  UNCLA3SIFIE.C 

CATE  12"2C-201^  BY  J7^JiSTSD  NSICG 


FD-302a(Rev,  10-6-95) 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  3/2/2016 


fU//Fetj0^  On  February  24,  2016,  S/^ 

iThe  package  was  provided  to  SA[ 


received  a FedEx  package  from 
Ion  March  2,  2016,  and  contained 


Report  was  returned  via  email  tc[ 
on  March  2,  2016.  ThereferencM 


|A  Grand  Jury  Subpoena  Duces  Tecum 

lof  the  U.S,  Attorney's  Office,  Eastern  District  of  Virginia, 


^e  attached  to  this  communication  in  a lA. 


b3 

b6 

bVC 

b7E 


Investigation  on  2/24/2016 at . 

File#  _ -GJ 


Washington.  DC 


^ Date  dictated N/A 


8ys£ 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  Jt  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b3 

b7E 

b6 
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HRC-3168 


b6 

b7C 


HRC-3169 
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TBI  imomiATlCm  CONTAIl-TEB 
HEKEII'l  IS  ™CLAS3I.FISC 
DA.TB  12"22-:^015  BY  J7^JiSTS0  NSICG 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  3/4/2016 


On  March  201 6.  S aT 


1rpr.pivpH  a package  froml 


referencedjj 


ontained  a response  to  subpoena 

A Grand  Jury  Subpoena  Duces  Tecum  Report  was  returned  via  email  to 

of  the  U.S.  Attorney's  Office,  Eastern  District  of  Virginia,  on  March  4,  2016.  The 


b3 

b6 

bVC 

b7E 


^e  attached  to  this  communication  in  a I A. 


b3 

bVE 


Investigation  on  3/3/2016  at . 
File# 


ByS4 


GJ 

Washington,  DC 


Date  dictated 


N/A 


JTiis  document  contains  neither  recommendations  nor  conclusions  of  the  FBF  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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HRC-3170 


hS 

bVC 
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^.LL  TBI  IHrQRi.£ATi™  CONTAIl-JBB 

HEKEII'l  IS  WCLA3S1F1ZL 

DA.TB  12-22-201^  BY  J7^JiSTS0  NSICG 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  3/09/2016 


(U//FGmr)  On  March  8,  2016,  SA| 

which  was  originally  received  hv  SaF 

in  response  subpoen^ 


received  and  emailed  subpoena  return  from 
The  email  contained 


lecum  Kepon  was  returned  via  email  tq 
Virginia,  on  March  9,  2016. 
communication  in  a lA. 


JA  Grand  Jury  Subpoena  Duces 


of  the  U.S.  Attorney's  Office,  Eastern  District  of 

and  is  attached  to  this 


b3 

b6 

b7C 

b7E 


Investigation  on  3/08/2016  at  Washintiton.  DC 

f il^  J ^ Date  dictated  N/A  _ 

b7E 


b6 
b7C 

This  document  contains  neither  recommendations  nor  conclusions  of  the  FBf  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency^ 


By^ 


HRC-3172 


hS 

bVC 


HRC-3173 


ALL  FEr  IHFCR^.iATi™  COUTAiriED 

HZKZIN  IS  UIJCLASSIFIED 

DATE  12'";:;"2D16  BY  J76J1STS0  HSICC 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  3/11/2016 


[ 


iU//rOUO)  On  March  7, 2016,  StJ 


subpoei^ 


Iwhich  was  originally  received  bv 


email  td 


A Gr 


received  and  email  subpoena  return  from 
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